Create a key
Open API Keys, choose a name and create the key. Copy the full owa_... token immediately.
Hashed at rest
The platform stores a hash and visible prefix rather than the recoverable full API key. If you lose the full token, revoke it and create another.
Use server-side
Send API keys from trusted backend code whenever possible. Do not publish production secrets inside browser JavaScript or public repositories.